Sample details: 46a695c9a3b93390c11c1c072cf9ef7d --

Hashes
MD5: 46a695c9a3b93390c11c1c072cf9ef7d
SHA1: f145181e095285feeb6897c9a6bd2e5f6585f294
SHA256: 2a694038d64bc9cfcd8caf6af35b6bfb29d2cb0c95baaeffb2a11cd6e60a73d1
SSDEEP: 6144:DESvxGKval4qpacXbw0gCZTcD9wyNJ6YV7A3NF7EFTx/fJUPJBHdq62LTS0xWY5g:DESZD44qpacX3gCmxYgHS9qNTBk
Details
File Type: PE32+
Added: 2018-03-07 03:14:02
Yara Hits
YRP/Microsoft_Visual_Cpp_80_DLL | YRP/IsPE64 | YRP/IsConsole | YRP/IsBeyondImageSize | YRP/HasRichSignature | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/Misc_Suspicious_Strings | YRP/anti_dbg | YRP/inject_thread | YRP/win_token | YRP/win_files_operation | YRP/Codoso_Gh0st_2 | YRP/Codoso_Gh0st_1 | FlorianRoth/Codoso_Gh0st_2 | FlorianRoth/Codoso_Gh0st_1 |
Source
http://167.114.128.52/1zzuac
Strings
		!This program cannot be run in DOS mode.
_!C;_l
_j@?_f
_j@:_f
_Richg
`.rdata
@.data
.pdata
@.rsrc
@.reloc
H9D$`w-H
D$XH9D$0s
L$XH9H
H9D$Xs
$H9D$8rHH
AH;D$8w
H9D$@s
L$8H9H
L$hH9H
H;D$pw
D$H9D$<
D$XH9D$0s
L$XH9H
H9D$Xs
$H9D$8rJH
H;D$8w
H9D$@s
L$8H9H
H9D$0u	
D$@9D$
L$hH9H
H;D$pw
H9D$hv)H
HcD$TH
u<HcD$TH
HcD$TH
HcD$\H
D$|9D$tu
H9D$@w
HkD$@HH
7HcD$0H
D$@HcD$0H
KHcD$0H
D$@HcD$0H
D$hH9D$8t%H
D$hH9D$8t%H
H9D$Xs
H9D$Xs
|$D$}-H
|$4$}-H
HcD$tH
H9D$(s
H9D$pw
HH+D$ H
HH+D$0H
H9D$(u
H9D$(u
H9D$(u
H9D$(u
IXHc	H
IPHc	H
H9D$@s
H9D$ s
H;D$Hw
H9D$@s
H9D$ s
H;D$Hw
H9D$8u
H9D$8u
D$HH9D$`t
D$HH9D$`t
D$hH9D$Ht
D$hH9D$Ht
D$PH9D$Ht
D$HH9D$@t
D$PH9D$Ht
D$pH9D$@t
D$hH9D$@t
D$hH9D$@t
D$`H9D$XteH
D$XH9D$Pt1H
D$XH9D$Pt1H
D$@H9D$8t"H
D$@H9D$8t#H
D$@H9D$8t"H
D$@H9D$8t#H
D$pH9D$htgH
D$8H9D$ 
L$8H9H
L$8H9H
H9D$ u
L$8H9H
@8HcL$
IXHc	H
IXHc	H
IXHc	H
H+D$8H;D$(s
H9D$(w
HH+D$ H
H+D$ H
HH+D$pH
H+D$`H
D$8H9D$@
@@HcL$
D$H9D$`u
HcD$$H
L$8H9Hhs+H
IXHc	H
L$@H9Hhs%H
H9D$ u
IXHc	H
HcD$$H
HcD$,H
HcD$ H
IPHc	H
HH9D$ s0H
H9D$@w6H
L$(H9Hhs%H
HcD$(H
D$0H9D$p}
HcD$@H
D$DHcD$DH
D$@HcD$@H
D$@9D$Hu
L$@H+A
H9D$ u H
H9D$ u H
H9D$`u
D$HH9D$@tR
H9D$ t
UVWAVAWH
D8:u2H
A_A^_^]
D9>tXA
l$ VWAVH
@USVWATAUAVAWH
A_A^A]A\_^[]
@USVWATAVAWH
A_A^A\_^[]
@USVWATAVAWH
A_A^A\_^[]
p WAVAWH
 A_A^_
SUVWATAUAVAWH
H+L$ x<H
8A_A^A]A\_^][
p WAVAWH
 A_A^_
UVWATAUAVAWH
l$pH9\$ u
H+L$(xBH
0A_A^A]A\_^]
@VWAVH
UWATAVAWH
A_A^A\_]
toH91uj
L9L$(L
UWAUAVAWH
A_A^A]_]
teH9Kxu
L9}'sA
UVWATAUAVAWH
pA_A^A]A\_^]
UVWATAUAVAWH
pA_A^A]A\_^]
USVWATAUAVAWH
)t$0Hc
HA_A^A]A\_^[]
UVWATAUAVAWH
`A_A^A]A\_^]
WATAUAVAWH
 A_A^A]A\_
WAVAWH
 A_A^_
USVWATAUAVAWH
)t$0Hc
HA_A^A]A\_^[]
UVWATAUAVAWH
pA_A^A]A\_^]
WATAUAVAWH
 A_A^A]A\_
USVWATAUAVAWH
)t$0Hc
HA_A^A]A\_^[]
UVWATAUAVAWH
pA_A^A]A\_^]
WATAUAVAWH
 A_A^A]A\_
uNfE9P
fffffff
VWATAVAWH
 A_A^A\_^
x ATAVAWH
 A_A^A\
ATAVAWH
 A_A^A\
fA;8utI
fA;0t)fA98t
VWATAVAWH
A_A^A\_^
UVWATAUAVAWH
G0Hc	H
A_A^A]A\_^]
D8eoupH
UVWATAUAVAWH
pA_A^A]A\_^]
WATAUAVAWH
 A_A^A]A\_
AUAVAWH
0A_A^A]
@SVWATAUAVAWH
L!|$@L!
D$HHcH
A_A^A]A\_^[
SVWATAUAVAWH
0A_A^A]A\_^[
WATAVH
@A^A\_
s WATAUAVAWH
9t$P~.8\$vt(H
9t$P~98\$vt3H
A_A^A]A\_
@UATAUAVAWH
!t$(H!t$ I
A_A^A]A\]
x ATAUAWH
@A_A]A\
AUAVAWH
0A_A^A]
WATAUAVAWH
 A_A^A]A\_
WAVAWH
 A_A^_
WATAUAVAWH
A_A^A]A\_
@SUVWATAVAWH
zu|D!t$ E3
A_A^A\_^][
WATAUAVAWH
@A_A^A]A\_
WATAUAVAWH
gfffffffH
D8L$Ht
A_A^A]A\_
x AUAVAWH
A_A^A]
@SUVWH
@SUVWH
@SUVWAVH
A^_^][
UVWATAUAVAWH
9D$LupE
A_A^A]A\_^]
WAVAWH
 A_A^_
UVWATAUAVAWH
0A_A^A]A\_^]
` AUAVAWH
t$8Hc0I
\$0D9=b"
A_A^A]
Hct$PH
seHcD$XH
fD9!u:A
fD93tSH
CfD93u
t$ WAVAWH
H3E H3E
l$ VWATAVAWH
T$&@8t$&t9@8r
A81t@@8r
A_A^A\_^
WAVAWH
fE98t'
0A_A^_
@USVWATAUAVAWH
A_A^A]A\_^[]
;Cu1f9K
f93t$M;
L$ SUVWH
|$ ATAVAWH
0A_A^A\
WATAUAVAWH
0A_A^A]A\_
\$ UVWATAUAVAWH
^fD9+t
A_A^A]A\_^]
\$ UVWATAUAVAWH
A_A^A]A\_^]
fD9|$bu
H9L$Ht8H
@UATAUAVAWH
A_A^A]A\]
x ATAVAWH
D8&t4H
D8d$Ht
A_A^A\
ATAVAWH
D8d$8t
@A_A^A\
\$ UVWATAUAVAWH
fD9 t	H
A_A^A]A\_^]
VWATAVAWH
 A_A^A\_^
\$ UVWATAUAVAWH
D9l$dtXH
HcD$PH;
HcD$PH;
A_A^A]A\_^]
t$ WATAUAVAW
A_A^A]A\_
VWATAVAWH
 A_A^A\_^
t$ WATAUAVAWH
D!l$h3
0A_A^A]A\_
@8l$8t
LcA<E3
@UATAUAVAWH
A_A^A]A\]
@USVWH
l$ VWAVH
9\$ ~>L
D82u&H
D8t$Ht
UATAUAVAWH
A_A^A]A\]
WATAUAVAWH
A_A^A]A\_
@SUVWATAVAWH
PA_A^A\_^][
f9.uVH
f9.u"H
tVf91tQH
@SUVWATAVAWH
3fD9 t
A_A^A\_^][
|$ AVH
tSf91tNH
D;|$0t9
x ATAVAWH
 A_A^A\
@USVWATAVAWH
tyfD9 tsH
tHfD9 tB
@A_A^A\_^[]
WATAUAVAWH
 A_A^A]A\_
USVWATAUAVAWH
8UXt$@
XA_A^A]A\_^[]
|$ UATAUAVAWH
A_A^A]A\]
|$ UATAUAVAWH
A_A^A]A\]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
 A_A^A]A\_^]
D8t$8t
WATAVH
H9E0w(H
H(H9J(u
string too long
invalid string position
generic
unknown error
iostream
iostream stream error
system
Invalid pid
Unable to obtain list of processes
Unable to find default process
Unable to setup named pipe
Too few arguments
Too few arguments
bad locale name
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
bad cast
0123456789ABCDEFabcdef-+Xx
0123456789-+Ee
0123456789ABCDEFabcdef-+XxPp
FreeLibrary
LoadLibraryW
GetProcAddress
CloseHandle
WaitForSingleObject
CoInitialize
CoUninitialize
CoGetObject
CoCreateInstance
SHCreateItemFromParsingName
ShellExecuteExW
CoInitialize
CoUninitialize
CoGetObject
CoCreateInstance
SHCreateItemFromParsingName
ShellExecuteExW
list<T> too long
map/set<T> too long
bad allocation
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
A0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefABCDEF
_hypot
Unknown exception
bad exception
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
CorExitProcess
_nextafter
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
(null)
`h````
xpxxxx
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
 delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
 new[]
 delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
 Type Descriptor'
 Base Class Descriptor at (
 Base Class Array'
 Class Hierarchy Descriptor'
 Complete Object Locator'
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
`h`hhh
xppwpp
1#SNAN
1#QNAN
CloseHandle
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReadFile
WriteFile
WriteConsoleInputW
GetStdHandle
ConnectNamedPipe
CreateNamedPipeW
SetEvent
WaitForSingleObject
CreateEventW
ExitProcess
CreateThread
GetModuleFileNameW
PulseEvent
WaitForMultipleObjects
lstrcmpiW
CopyFileW
GetConsoleWindow
CreateRemoteThread
FreeLibrary
GetProcAddress
LoadLibraryW
CreateFileW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetLastError
GetCurrentProcess
OpenProcess
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WriteProcessMemory
LoadResource
LockResource
SizeofResource
FindResourceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
KERNEL32.dll
OpenProcessToken
GetTokenInformation
ADVAPI32.dll
SHGetFolderPathW
SHELL32.dll
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCommandLineW
GetCPInfo
HeapAlloc
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThreadId
GetModuleHandleExW
HeapSize
GetProcessHeap
IsDebuggerPresent
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
ReadConsoleW
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AV_System_error@std@@
.?AVbad_cast@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ios@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_istream@_WU?$char_traits@_W@std@@@std@@
.?AV_Facet_base@std@@
.?AVfacet@locale@std@@
.?AUctype_base@std@@
.?AV?$ctype@D@std@@
.?AV?$ctype@_W@std@@
.?AV?$numpunct@_W@std@@
.?AV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@
.?AV?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@
.?AV?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AVCTempResource@W7EUtils@@
.?AVCRemoteMemory@W7EUtils@@
.?AVbad_alloc@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AV_Locimp@locale@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AVcodecvt_base@std@@
.?AV?$codecvt@DDH@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.reloc
SVWAVH
8A^_^[
SVWAVAWH
0A_A^_^[
ATAVAWH
 A_A^A\
VWATAVAWH
 A_A^A\_^
x ATAVAWH
 A_A^A\
fffffff
WATAUAVAWH
@A_A^A]A\_
WATAUAVAWH
A_A^A]A\_
VWATAVAWH
A_A^A\_^
UVWATAUAVAWH
G0Hc	H
A_A^A]A\_^]
D8eoupH
UVWATAUAVAWH
pA_A^A]A\_^]
WATAUAVAWH
 A_A^A]A\_
AUAVAWH
0A_A^A]
@SVWATAUAVAWH
L!|$@L!
D$HHcH
A_A^A]A\_^[
SVWATAUAVAWH
0A_A^A]A\_^[
WATAVH
@A^A\_
WATAUAVAWH
gfffffffH
D8L$Ht
A_A^A]A\_
x AUAVAWH
A_A^A]
@SUVWH
@SUVWH
@SUVWAVH
A^_^][
` AUAVAWH
t$8Hc0I
\$0D9=
A_A^A]
Hct$@H
sYHcL$HH
x ATAVAWH
< tD<	t@
 A_A^A\
H3E H3E
t$ WATAUAVAWH
D!l$h3
0A_A^A]A\_
t$ WAVAWH
LcA<E3
l$ VWATAVAWH
T$&@8t$&t9@8r
A81t@@8r
A_A^A\_^
@USVWH
@SUVWATAVAWH
tcH95=
PA_A^A\_^][
@UATAUAVAWH
!t$(H!t$ I
A_A^A]A\]
@UATAUAVAWH
A_A^A]A\]
AUAVAWH
0A_A^A]
|$ UATAUAVAWH
A_A^A]A\]
|$ UATAUAVAWH
A_A^A]A\]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
VWATAVAWH
 A_A^A\_^
\$ UVWATAUAVAWH
D9l$dtXH
HcD$PH;
HcD$PH;
A_A^A]A\_^]
WATAVH
D82u&H
D8t$Ht
H(H9J(u
generic
unknown error
iostream
iostream stream error
system
string too long
invalid string position
bad allocation
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
_hypot
Unknown exception
CorExitProcess
bad exception
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
_nextafter
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
 delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
 new[]
 delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
 Type Descriptor'
 Base Class Descriptor at (
 Base Class Array'
 Class Hierarchy Descriptor'
 Complete Object Locator'
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#SNAN
1#QNAN
CloseHandle
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ExitProcess
CreateProcessW
KERNEL32.dll
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
SetLastError
IsDebuggerPresent
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.reloc
SVWAVH
8A^_^[
SVWAVAWH
0A_A^_^[
|$ UAVAWH
D8sHt,@
ATAVAWH
 A_A^A\
VWATAVAWH
 A_A^A\_^
x ATAVAWH
 A_A^A\
fffffff
WATAUAVAWH
@A_A^A]A\_
WATAUAVAWH
A_A^A]A\_
VWATAVAWH
A_A^A\_^
UVWATAUAVAWH
G0Hc	H
A_A^A]A\_^]
D8eoupH
UVWATAUAVAWH
pA_A^A]A\_^]
WATAUAVAWH
 A_A^A]A\_
AUAVAWH
0A_A^A]
@SVWATAUAVAWH
L!|$@L!
D$HHcH
A_A^A]A\_^[
SVWATAUAVAWH
0A_A^A]A\_^[
WATAVH
@A^A\_
WATAUAVAWH
gfffffffH
D8L$Ht
A_A^A]A\_
x AUAVAWH
A_A^A]
@SUVWH
@SUVWH
@SUVWAVH
A^_^][
` AUAVAWH
t$8Hc0I
\$0D9=
A_A^A]
Hct$PH
seHcD$XH
fD9!u:A
fD93tSH
CfD93u
t$ WAVAWH
H3E H3E
t$ WATAUAVAWH
D!l$h3
0A_A^A]A\_
LcA<E3
l$ VWATAVAWH
T$&@8t$&t9@8r
A81t@@8r
A_A^A\_^
@USVWH
@SUVWATAVAWH
PA_A^A\_^][
@UATAUAVAWH
!t$(H!t$ I
A_A^A]A\]
@UATAUAVAWH
A_A^A]A\]
AUAVAWH
0A_A^A]
|$ UATAUAVAWH
A_A^A]A\]
|$ UATAUAVAWH
A_A^A]A\]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
VWATAVAWH
 A_A^A\_^
\$ UVWATAUAVAWH
D9l$dtXH
HcD$PH;
HcD$PH;
A_A^A]A\_^]
WATAVH
D82u&H
D8t$Ht
H(H9J(u
generic
unknown error
iostream
iostream stream error
system
string too long
invalid string position
bad allocation
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
_hypot
Unknown exception
CorExitProcess
bad exception
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
_nextafter
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
 delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
 new[]
 delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
 Type Descriptor'
 Base Class Descriptor at (
 Base Class Array'
 Class Hierarchy Descriptor'
 Complete Object Locator'
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#SNAN
1#QNAN
CloseHandle
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReadFile
WriteFile
WriteConsoleInputW
GetStdHandle
SetStdHandle
CreateFileW
CreatePipe
TerminateProcess
CreateThread
CreateProcessW
WaitForMultipleObjects
KERNEL32.dll
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
SetLastError
GetCurrentThreadId
IsDebuggerPresent
GetProcessHeap
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*' />
    </dependentAssembly>
  </dependency>
</assembly>